ml

cmd/needle-sidecar/Dockerfile

@@ -0,0 +1,28 @@
+FROM python:3.12-slim
+
+# Create non-root user with UID 1000 matching Kubernetes pod securityContext
+RUN groupadd -g 1000 appuser && useradd -u 1000 -g appuser -m -d /app appuser
+
+WORKDIR /app
+
+ENV HOME=/app
+ENV NEEDLE_PORT=5005
+ENV NEEDLE_HOST=0.0.0.0
+ENV NEEDLE_TELEMETRY=0
+
+# Install dependencies
+RUN pip install --no-cache-dir cactus-needle
+
+# Pre-cache model and shared library into /app/.cache as user 1000
+RUN python -c "import needle; needle.Needle()"
+
+COPY server.py /app/server.py
+
+# Ensure UID 1000 owns /app and all caches
+RUN chown -R appuser:appuser /app
+
+USER appuser
+
+EXPOSE 5005
+
+CMD ["python", "/app/server.py"]